Contents

Part 0 — Start here

• 0.1 Who this is for, and what the first guide assumed
• 0.2 The advanced learning flow: think in attack paths, assume breach
• 0.3 Three routes: cloud, appsec, platform/detection
• 0.4 The advanced lab: cloud sandboxes, a local cluster, budget guardrails
• 0.5 Ethics, cloud provider policy, and not setting money on fire
• 0.6 The running example grows up: cloud-native, multi-tenant SecureShop
• 0.7 The series: OS → networking → security → HTTPS
• 0.8 The Go labs: security mechanisms you can run

Part 1 — Attack paths and adversary thinking

1. From vulnerabilities to attack paths
2. Adversary emulation and purple teaming
3. Assume breach: lateral movement, persistence, and containment by design
4. Threat modeling at scale

Part 2 — Cloud security foundations 5. The cloud security model and the identity plane 6. Cloud IAM in depth: policy evaluation and privilege-escalation paths 7. Organisation structure and guardrails 8. Cloud network security 9. Data security in the cloud: KMS and envelope encryption 10. Hands-on: attack and defend a cloud account

Part 3 — Infrastructure as Code and the deployment pipeline 11. IaC security 12. CI/CD as an attack surface 13. Securing the software factory: provenance and admission 14. Hands-on: a supply-chain-hardened pipeline

Part 4 — Container and Kubernetes security 15. Container internals and isolation 16. Kubernetes architecture and its trust boundaries 17. Kubernetes RBAC and identity 18. Admission control and policy 19. Kubernetes network security 20. Runtime security and workload identity 21. Multi-tenancy and isolation models 22. Hands-on: attack a cluster, then harden it

Part 5 — Microservices and distributed authorization 23. Service identity: SPIFFE and SPIRE 24. Token exchange and delegation 25. Distributed authorization: RBAC to ABAC to ReBAC/Zanzibar 26. East-west security: internal APIs, gRPC, and event streams 27. Multi-tenant data isolation 28. Resilience as a security property 29. Hands-on: end-to-end authorization for SecureShop

Part 6 — Advanced web and API exploitation 30. HTTP request smuggling and desync 31. Web cache poisoning and cache deception 32. XXE and the XML attack surface 33. SSRF mastery 34. Prototype pollution, DOM clobbering, and mutation XSS 35. Web race conditions 36. Server-side template and expression-language injection 37. Deserialization attacks 38. File upload and parser attacks 39. Federated identity attacks: SAML and advanced OAuth/OIDC 40. Hands-on: chain bugs into account takeover or RCE

Part 6A — API gateway and perimeter security 40A. API payload security in depth 40B. API rate limiting in depth 40C. WAF: architecture, rules, and bypasses 40D. WAAP: bots, API discovery, and edge enforcement 40E. Implementing the OWASP API Security Top 10 (2023)

Part 7 — Data protection and privacy engineering 41. Data classification, inventory, and data-flow mapping 42. Encryption at rest, done properly 43. Tokenization, FPE, and PCI scope reduction 44. Key management lifecycle 45. De-identification and privacy-preserving analytics 46. The right to erasure across a distributed system 47. Data residency, sovereignty, and transfer 48. Database security in depth 49. Data-access governance and insider risk 50. Hands-on: build SecureShop's data-protection layer

Part 8 — Detection engineering and response at scale 51. The detection-engineering lifecycle 52. Telemetry architecture 53. Threat hunting and threat intelligence 54. Detecting the attack paths from Part 1 55. Incident response for cloud and containers 56. Ransomware and destructive-attack resilience 57. Hands-on: build and validate a detection suite

Part 9 — The security program 58. Building an SSDLC / product-security program 59. Vulnerability management at scale 60. The offensive program: pentest, red team, bug bounty, VDP 61. Compliance and assurance without theater 62. Risk, metrics, and communicating with leadership 63. Enterprise identity and access

Part 10 — Capstone projects 64. Project 1: cloud-native SecureShop — model, build, attack, defend 65. Project 2: distributed authorization with proven tenant isolation 66. Project 3: an advanced web assessment to ATO/RCE 67. Project 4: emulate an intrusion, detect every stage, run the IR 68. Project 5: the data-protection and privacy layer

Part 11 — Expert breadth: adjacent domains senior security engineers must understand 69. AI, LLM, and agentic-system security 70. Mobile application security 71. Endpoint, Active Directory, Entra ID, and EDR realities 72. Email security, phishing resilience, and BEC 73. Secrets management and credential lifecycle 74. Abuse, fraud, bots, and business-logic defense 75. Digital forensics and malware triage 76. IoT, OT, embedded, and physical-world security 77. Security architecture review: the senior-engineer playbook 78. Capstone: a board-to-packet security review

Part 12 — Where to go next 79. Deep specialisation tracks and the research frontier 80. Staying current at the advanced level, and contributing back

Appendices

• A. Advanced glossary
• B. Cloud attack-path reference (AWS / GCP / Azure)
• C. Kubernetes security checklist
• D. Distributed authorization patterns reference
• E. Data-protection decision tables
• F. Detection coverage map (ATT&CK technique to data source to rule)
• G. Answers to "Check yourself"